COMP 3000 Lab 7 2011 - Revision history

Saran: /* Part B */

2011-12-12T21:28:57Z

Part B

← Older revision		Revision as of 21:28, 12 December 2011
Line 55:		Line 55:
	===Part B ===		===Part B ===
	# Tracepath/Traceroute either use ICMP echo requests, or simply send a UDP packet to a big port number, and wait for ICMP destination unreachable packet. In either case, if a server doesn't receive an ICMP packet as response, tracepath says "no reply". See [http://en.wikipedia.org/wiki/Traceroute here] or [http://www.inetdaemon.com/tutorials/troubleshooting/tools/traceroute/definition.shtml here]. Tracepath is essentially the same as traceroute.		# Tracepath/Traceroute either use ICMP echo requests, or simply send a UDP packet to a big port number, and wait for ICMP destination unreachable packet. In either case, if a server doesn't receive an ICMP packet as response, tracepath says "no reply". See [http://en.wikipedia.org/wiki/Traceroute here] or [http://www.inetdaemon.com/tutorials/troubleshooting/tools/traceroute/definition.shtml here]. Tracepath is essentially the same as traceroute.
	# I see the following system calls : poll, read and write. Poll waits for the file descriptor status to change, until it is ready to perform I/O. read reads a fixed number of bytes into a buffer from a file descriptor, and write writes a given number of bytes to a file descriptor.		# I see the following system calls : poll, read and write. Poll waits for the file descriptor status to change, until it is ready to perform I/O. read reads a fixed number of bytes into a buffer from a file descriptor, and write writes a given number of bytes to a file descriptor. The question asks for system calls used in the "steady state", not for setting up etc. Use strace to check.
	# /proc/net/tcp. Syntactically, the ip addresses and port numbers in netstat are human-readable and not in hex. The state values have been translated from numbers to words. Further, if used with flags, ( like --program ), netstat retrieves the application name related to the connection, by looking up inode info from /proc/net/tcp.		# /proc/net/tcp. Syntactically, the ip addresses and port numbers in netstat are human-readable and not in hex. The state values have been translated from numbers to words. Further, if used with flags, ( like --program ), netstat retrieves the application name related to the connection, by looking up inode info from /proc/net/tcp.
	# When lsof recurses through a directory, and encounters a file that it cannot open, it says "permission denied". This is because ordinary users don't have access to some protected files ( for e.g /etc/shadow )		# When lsof recurses through a directory, and encounters a file that it cannot open, it says "permission denied". This is because ordinary users don't have access to some protected files ( for e.g /etc/shadow )

Saran: /* Part B */

2011-12-07T22:28:27Z

Part B

← Older revision		Revision as of 22:28, 7 December 2011
Line 54:		Line 54:

	===Part B ===		===Part B ===
	# Tracepath/Traceroute either use ICMP echo requests, or simply send a UDP packet to a big port number, and wait for ICMP destination unreachable packet. In either case, if a server doesn't receive an ICMP packet as response, tracepath says "no reply".		# Tracepath/Traceroute either use ICMP echo requests, or simply send a UDP packet to a big port number, and wait for ICMP destination unreachable packet. In either case, if a server doesn't receive an ICMP packet as response, tracepath says "no reply". See [http://en.wikipedia.org/wiki/Traceroute here] or [http://www.inetdaemon.com/tutorials/troubleshooting/tools/traceroute/definition.shtml here]. Tracepath is essentially the same as traceroute.
	# I see the following system calls : poll, read and write. Poll waits for the file descriptor status to change, until it is ready to perform I/O. read reads a fixed number of bytes into a buffer from a file descriptor, and write writes a given number of bytes to a file descriptor.		# I see the following system calls : poll, read and write. Poll waits for the file descriptor status to change, until it is ready to perform I/O. read reads a fixed number of bytes into a buffer from a file descriptor, and write writes a given number of bytes to a file descriptor.
	# /proc/net/tcp. Syntactically, the ip addresses and port numbers in netstat are human-readable and not in hex. The state values have been translated from numbers to words. Further, if used with flags, ( like --program ), netstat retrieves the application name related to the connection, by looking up inode info from /proc/net/tcp.		# /proc/net/tcp. Syntactically, the ip addresses and port numbers in netstat are human-readable and not in hex. The state values have been translated from numbers to words. Further, if used with flags, ( like --program ), netstat retrieves the application name related to the connection, by looking up inode info from /proc/net/tcp.

Saran: /* Part B */

2011-12-07T21:27:09Z

Part B

← Older revision		Revision as of 21:27, 7 December 2011
Line 58:		Line 58:
	# /proc/net/tcp. Syntactically, the ip addresses and port numbers in netstat are human-readable and not in hex. The state values have been translated from numbers to words. Further, if used with flags, ( like --program ), netstat retrieves the application name related to the connection, by looking up inode info from /proc/net/tcp.		# /proc/net/tcp. Syntactically, the ip addresses and port numbers in netstat are human-readable and not in hex. The state values have been translated from numbers to words. Further, if used with flags, ( like --program ), netstat retrieves the application name related to the connection, by looking up inode info from /proc/net/tcp.
	# When lsof recurses through a directory, and encounters a file that it cannot open, it says "permission denied". This is because ordinary users don't have access to some protected files ( for e.g /etc/shadow )		# When lsof recurses through a directory, and encounters a file that it cannot open, it says "permission denied". This is because ordinary users don't have access to some protected files ( for e.g /etc/shadow )
	# In [http://lxr.linux.no/linux+v3.1.4/include/linux/mm_types.h#L187 include/linux/mm_types.h], the following are used to store permissions.		# In [http://lxr.linux.no/linux+v3.1.4/include/linux/mm_types.h#L187 include/linux/mm_types.h], the following are used to store permissions. ( Some of you've answered "Virtual Memory Area" - which is very vague. You need to specify the exact structure and the fields used in that ).
	pgprot_t vm_page_prot; /* Access permissions of this VMA. */		pgprot_t vm_page_prot; /* Access permissions of this VMA. */
	unsigned long vm_flags; /* Flags, see mm.h. */		unsigned long vm_flags; /* Flags, see mm.h. */

Saran: /* Part A */

2011-12-07T21:07:53Z

Part A

← Older revision		Revision as of 21:07, 7 December 2011
Line 25:		Line 25:
	==Answers==		==Answers==
	===Part A===		===Part A===
	# inet address is the IPv4 address of the host. The [http://en.wikipedia.org/wiki/Reserved_IP_addresses#Reserved_IPv4_addresses scope] is usually either a subnet or global, the former meaning other computers on the same subnet can talk, and the latter meaning any computer with an access to the Internet can talk to this one. HWaddr is the MAC address of the network card. Computers on the same local network (ethernet/wifi etc) connected via a switch or a hub or some such device can talk to it without having to use the Network layer. inet6 address, or the IPv6 address is a newer replacement for the aging IPv4 address. If ~~it's~~ [http://en.wikipedia.org/wiki/IPv6_address#IPv6_address_scopes scope] is only link, that means it doesn't have a globally routable address. Routers drop packets that originate with a [http://en.wikipedia.org/wiki/Link-local_address link-local] address. A global scope means a globally routable ipv6 address.		# inet address is the IPv4 address of the host. The [http://en.wikipedia.org/wiki/Reserved_IP_addresses#Reserved_IPv4_addresses scope] is usually either a subnet or global, the former meaning other computers on the same subnet can talk, and the latter meaning any computer with an access to the Internet can talk to this one. HWaddr is the MAC address of the network card. Computers on the same local network (ethernet/wifi etc) connected via a switch or a hub or some such device can talk to it without having to use the Network layer. inet6 address, or the IPv6 address is a newer replacement for the aging IPv4 address. If its [http://en.wikipedia.org/wiki/IPv6_address#IPv6_address_scopes scope] is only link, that means it doesn't have a globally routable address. Routers drop packets that originate with a [http://en.wikipedia.org/wiki/Link-local_address link-local] address. A global scope means a globally routable ipv6 address.
	# MTU, or the Maximum Transmission Unit, is the maximum frame size of whatever layer 2 protocol is under use, ( e.g Ethernet ). Some of you've answered that MTU is the maximum IP packet size - that is [http://superuser.com/questions/220429/what-layer-does-ifconfig-operate-at incorrect]. You can verify it if you'd like by changing mtu of your eth0, running Wireshark, and looking at frame length ( which in my case seems to be upper-bounded by MTU + 14 bytes ). I'm unsure about what those additional 14 bytes are. Although, technically, you can limit the size of all egress IP packets from your NIC, typically IP layer dynamically figures out its MTUs - because they vary. See [http://en.wikipedia.org/wiki/Maximum_transmission_unit#Path_MTU_Discovery here] and [http://linux-ip.net/html/routing-icmp.html#routing-icmp-mtu here] for more info.		# MTU, or the Maximum Transmission Unit, is the maximum frame size of whatever layer 2 protocol is under use, ( e.g Ethernet ). Some of you've answered that MTU is the maximum IP packet size - that is [http://superuser.com/questions/220429/what-layer-does-ifconfig-operate-at incorrect]. You can verify it if you'd like by changing mtu of your eth0, running Wireshark, and looking at frame length ( which in my case seems to be upper-bounded by MTU + 14 bytes ). I'm unsure about what those additional 14 bytes are. Although, technically, you can limit the size of all egress IP packets from your NIC, typically IP layer dynamically figures out its MTUs - because they vary. See [http://en.wikipedia.org/wiki/Maximum_transmission_unit#Path_MTU_Discovery here] and [http://linux-ip.net/html/routing-icmp.html#routing-icmp-mtu here] for more info.
	# nc -l 9200 > /tmp/foo		# nc -l 9200 > /tmp/foo

Saran: /* Part A */

2011-12-07T20:46:20Z

Part A

← Older revision		Revision as of 20:46, 7 December 2011
Line 26:		Line 26:
	===Part A===		===Part A===
	# inet address is the IPv4 address of the host. The [http://en.wikipedia.org/wiki/Reserved_IP_addresses#Reserved_IPv4_addresses scope] is usually either a subnet or global, the former meaning other computers on the same subnet can talk, and the latter meaning any computer with an access to the Internet can talk to this one. HWaddr is the MAC address of the network card. Computers on the same local network (ethernet/wifi etc) connected via a switch or a hub or some such device can talk to it without having to use the Network layer. inet6 address, or the IPv6 address is a newer replacement for the aging IPv4 address. If it's [http://en.wikipedia.org/wiki/IPv6_address#IPv6_address_scopes scope] is only link, that means it doesn't have a globally routable address. Routers drop packets that originate with a [http://en.wikipedia.org/wiki/Link-local_address link-local] address. A global scope means a globally routable ipv6 address.		# inet address is the IPv4 address of the host. The [http://en.wikipedia.org/wiki/Reserved_IP_addresses#Reserved_IPv4_addresses scope] is usually either a subnet or global, the former meaning other computers on the same subnet can talk, and the latter meaning any computer with an access to the Internet can talk to this one. HWaddr is the MAC address of the network card. Computers on the same local network (ethernet/wifi etc) connected via a switch or a hub or some such device can talk to it without having to use the Network layer. inet6 address, or the IPv6 address is a newer replacement for the aging IPv4 address. If it's [http://en.wikipedia.org/wiki/IPv6_address#IPv6_address_scopes scope] is only link, that means it doesn't have a globally routable address. Routers drop packets that originate with a [http://en.wikipedia.org/wiki/Link-local_address link-local] address. A global scope means a globally routable ipv6 address.
	# MTU, or the Maximum Transmission Unit, is the maximum frame size of whatever layer 2 protocol is under use, ( e.g Ethernet ). Some of you've answered that MTU is the maximum IP packet size - that is [~~incorrect~~ http://superuser.com/questions/220429/what-layer-does-ifconfig-operate-at ]. You can verify it if you'd like by changing mtu of your eth0, running Wireshark, and looking at frame length ( which in my case seems to be upper-bounded by MTU + 14 bytes ). I'm unsure about what those additional 14 bytes are. Although, technically, you can limit the size of all egress IP packets from your NIC, typically IP layer dynamically figures out its MTUs - because they vary. See [http://en.wikipedia.org/wiki/Maximum_transmission_unit#Path_MTU_Discovery here] and [http://linux-ip.net/html/routing-icmp.html#routing-icmp-mtu here] for more info.		# MTU, or the Maximum Transmission Unit, is the maximum frame size of whatever layer 2 protocol is under use, ( e.g Ethernet ). Some of you've answered that MTU is the maximum IP packet size - that is [http://superuser.com/questions/220429/what-layer-does-ifconfig-operate-at incorrect]. You can verify it if you'd like by changing mtu of your eth0, running Wireshark, and looking at frame length ( which in my case seems to be upper-bounded by MTU + 14 bytes ). I'm unsure about what those additional 14 bytes are. Although, technically, you can limit the size of all egress IP packets from your NIC, typically IP layer dynamically figures out its MTUs - because they vary. See [http://en.wikipedia.org/wiki/Maximum_transmission_unit#Path_MTU_Discovery here] and [http://linux-ip.net/html/routing-icmp.html#routing-icmp-mtu here] for more info.
	# nc -l 9200 > /tmp/foo		# nc -l 9200 > /tmp/foo
	# From a lambda machine, I got this :		# From a lambda machine, I got this :

Saran: /* Part A */

2011-12-07T20:46:04Z

Part A

← Older revision		Revision as of 20:46, 7 December 2011
Line 26:		Line 26:
	===Part A===		===Part A===
	# inet address is the IPv4 address of the host. The [http://en.wikipedia.org/wiki/Reserved_IP_addresses#Reserved_IPv4_addresses scope] is usually either a subnet or global, the former meaning other computers on the same subnet can talk, and the latter meaning any computer with an access to the Internet can talk to this one. HWaddr is the MAC address of the network card. Computers on the same local network (ethernet/wifi etc) connected via a switch or a hub or some such device can talk to it without having to use the Network layer. inet6 address, or the IPv6 address is a newer replacement for the aging IPv4 address. If it's [http://en.wikipedia.org/wiki/IPv6_address#IPv6_address_scopes scope] is only link, that means it doesn't have a globally routable address. Routers drop packets that originate with a [http://en.wikipedia.org/wiki/Link-local_address link-local] address. A global scope means a globally routable ipv6 address.		# inet address is the IPv4 address of the host. The [http://en.wikipedia.org/wiki/Reserved_IP_addresses#Reserved_IPv4_addresses scope] is usually either a subnet or global, the former meaning other computers on the same subnet can talk, and the latter meaning any computer with an access to the Internet can talk to this one. HWaddr is the MAC address of the network card. Computers on the same local network (ethernet/wifi etc) connected via a switch or a hub or some such device can talk to it without having to use the Network layer. inet6 address, or the IPv6 address is a newer replacement for the aging IPv4 address. If it's [http://en.wikipedia.org/wiki/IPv6_address#IPv6_address_scopes scope] is only link, that means it doesn't have a globally routable address. Routers drop packets that originate with a [http://en.wikipedia.org/wiki/Link-local_address link-local] address. A global scope means a globally routable ipv6 address.
	# MTU, or the Maximum Transmission Unit, is the maximum frame size of whatever layer 2 protocol is under use, ( e.g Ethernet ).		# MTU, or the Maximum Transmission Unit, is the maximum frame size of whatever layer 2 protocol is under use, ( e.g Ethernet ). Some of you've answered that MTU is the maximum IP packet size - that is [incorrect http://superuser.com/questions/220429/what-layer-does-ifconfig-operate-at ]. You can verify it if you'd like by changing mtu of your eth0, running Wireshark, and looking at frame length ( which in my case seems to be upper-bounded by MTU + 14 bytes ). I'm unsure about what those additional 14 bytes are. Although, technically, you can limit the size of all egress IP packets from your NIC, typically IP layer dynamically figures out its MTUs - because they vary. See [http://en.wikipedia.org/wiki/Maximum_transmission_unit#Path_MTU_Discovery here] and [http://linux-ip.net/html/routing-icmp.html#routing-icmp-mtu here] for more info.
	# nc -l 9200 > /tmp/foo		# nc -l 9200 > /tmp/foo
	# From a lambda machine, I got this :		# From a lambda machine, I got this :

Saran: /* Part B */ How did the last question of part B change???

2011-12-07T20:17:54Z

Part B: How did the last question of part B change???

← Older revision		Revision as of 20:17, 7 December 2011
Line 21:		Line 21:
	# [2] What file does <tt>netstat</tt> access to find out about current TCP connections on Linux? And, what is the difference between this file and the output of <tt>netstat</tt>, in syntax and semantics? Be specific.		# [2] What file does <tt>netstat</tt> access to find out about current TCP connections on Linux? And, what is the difference between this file and the output of <tt>netstat</tt>, in syntax and semantics? Be specific.
	# [2] What does <tt>lsof</tt> sometimes get a "permission denied" error when run as a regular user? Specifically, what files is it trying to access, and why are these protected?		# [2] What does <tt>lsof</tt> sometimes get a "permission denied" error when run as a regular user? Specifically, what files is it trying to access, and why are these protected?
	# [2] ~~Can you tell from <tt>~~/proc/<PID>/maps~~</tt> which memory segments are shared for read-only access? What about read-write access~~? ~~Explain briefly.~~		# [2] What kernel data structure stores the permissions listed in /proc/<PID>/maps?

	==Answers==		==Answers==

Saran: /* Part A */

2011-12-07T19:57:16Z

Part A

← Older revision		Revision as of 19:57, 7 December 2011
Line 10:		Line 10:
	# [3] Run <tt>ifconfig</tt>. For all configured interfaces except loopback, there should be an "inet" address, a "HWaddr" (hardware) address, and perhaps even an "inet6" address. Each of these addresses identifies the computer within a certain context. In what context are each of these addresses used? Specifically, for what protocol is the address used, and what other computers can access this one using this address? (Ignore NAT issues.)		# [3] Run <tt>ifconfig</tt>. For all configured interfaces except loopback, there should be an "inet" address, a "HWaddr" (hardware) address, and perhaps even an "inet6" address. Each of these addresses identifies the computer within a certain context. In what context are each of these addresses used? Specifically, for what protocol is the address used, and what other computers can access this one using this address? (Ignore NAT issues.)
	# [2] What does MTU refer to in the output of <tt>ifconfig</tt>? Specifically, what does the acronym mean, and what does this value determine?		# [2] What does MTU refer to in the output of <tt>ifconfig</tt>? Specifically, what does the acronym mean, and what does this value determine?
	# How could you use netcat (<tt>nc</tt>) to listen on port 9200 and write received data to the file /tmp/foo?		# [1] How could you use netcat (<tt>nc</tt>) to listen on port 9200 and write received data to the file /tmp/foo?
	# What does <tt>tracepath slashdot.org</tt> return?		# [1] What does <tt>tracepath slashdot.org</tt> return?
	# How can you get <tt>netstat</tt> to return a list of all current TCP connections and open ports, listed using numeric IP addresses (rather than DNS hostnames)?		# [1] How can you get <tt>netstat</tt> to return a list of all current TCP connections and open ports, listed using numeric IP addresses (rather than DNS hostnames)?
	# How could I use <tt>lsof</tt> to find all of the processes accessing the directory <tt>/home</tt>?		# [1] How could I use <tt>lsof</tt> to find all of the processes accessing the directory <tt>/home</tt>?
	# [2] In <tt>/proc/<PID>/maps</tt>, each entry has four permission bits: r,w,x, & p. What do each of them indicate?		# [2] In <tt>/proc/<PID>/maps</tt>, each entry has four permission bits: r,w,x, & p. What do each of them indicate?

Saran: /* Part B */

2011-12-05T04:39:28Z

Part B

← Older revision		Revision as of 04:39, 5 December 2011
Line 58:		Line 58:
	# /proc/net/tcp. Syntactically, the ip addresses and port numbers in netstat are human-readable and not in hex. The state values have been translated from numbers to words. Further, if used with flags, ( like --program ), netstat retrieves the application name related to the connection, by looking up inode info from /proc/net/tcp.		# /proc/net/tcp. Syntactically, the ip addresses and port numbers in netstat are human-readable and not in hex. The state values have been translated from numbers to words. Further, if used with flags, ( like --program ), netstat retrieves the application name related to the connection, by looking up inode info from /proc/net/tcp.
	# When lsof recurses through a directory, and encounters a file that it cannot open, it says "permission denied". This is because ordinary users don't have access to some protected files ( for e.g /etc/shadow )		# When lsof recurses through a directory, and encounters a file that it cannot open, it says "permission denied". This is because ordinary users don't have access to some protected files ( for e.g /etc/shadow )
	# In include/linux/mm_types.h, the following are used to store permissions.		# In [http://lxr.linux.no/linux+v3.1.4/include/linux/mm_types.h#L187 include/linux/mm_types.h], the following are used to store permissions.
	pgprot_t vm_page_prot; /* Access permissions of this VMA. */		pgprot_t vm_page_prot; /* Access permissions of this VMA. */
	unsigned long vm_flags; /* Flags, see mm.h. */		unsigned long vm_flags; /* Flags, see mm.h. */

Saran: /* Part B */

2011-12-05T04:38:53Z

Part B

← Older revision		Revision as of 04:38, 5 December 2011
Line 58:		Line 58:
	# /proc/net/tcp. Syntactically, the ip addresses and port numbers in netstat are human-readable and not in hex. The state values have been translated from numbers to words. Further, if used with flags, ( like --program ), netstat retrieves the application name related to the connection, by looking up inode info from /proc/net/tcp.		# /proc/net/tcp. Syntactically, the ip addresses and port numbers in netstat are human-readable and not in hex. The state values have been translated from numbers to words. Further, if used with flags, ( like --program ), netstat retrieves the application name related to the connection, by looking up inode info from /proc/net/tcp.
	# When lsof recurses through a directory, and encounters a file that it cannot open, it says "permission denied". This is because ordinary users don't have access to some protected files ( for e.g /etc/shadow )		# When lsof recurses through a directory, and encounters a file that it cannot open, it says "permission denied". This is because ordinary users don't have access to some protected files ( for e.g /etc/shadow )
	#		# In include/linux/mm_types.h, the following are used to store permissions.
			pgprot_t vm_page_prot; /* Access permissions of this VMA. */
			unsigned long vm_flags; /* Flags, see mm.h. */